AshOnetime.Token (ash_onetime v0.2.0)

Copy Markdown View Source

Mints, signs, and verifies bounded self-identifying canonical tokens.

The signed body binds the algorithm, key identifier, namespace, keyed-effect key, issuance instant, and optional expiry instant. Verification requires an expected algorithm and namespace supplied outside the token.

Summary

Types

algorithm()
result(value)
t()

Functions

mint(key, options)
sign(token, resolver, resolver_context)
verify(encoded, resolver, options)

Types

algorithm()

@type algorithm() :: :hmac_sha256 | :ed25519

result(value)

@type result(value) :: {:ok, value} | {:error, AshOnetime.Error.t()}

t()

@type t() :: %AshOnetime.Token{
  algorithm: algorithm(),
  expires_at: DateTime.t() | nil,
  issued_at: DateTime.t(),
  key: binary(),
  key_id: binary(),
  namespace: binary()
}

Functions

mint(key, options)

@spec mint(
  binary(),
  keyword()
) :: result(t())

sign(token, resolver, resolver_context)

@spec sign(t(), module(), term()) :: result(binary())

verify(encoded, resolver, options)

@spec verify(binary(), module(), keyword()) :: result(t())